Constantin Schwarz

The Kiuwan Local Analyzer (KLA) Java scanning application contains several hard-coded secrets in plain text format, potentially compromising the confidentiality of scan results. Credentials were found in the JAR files, including `insight.github.user` and `insight.github.password` in the "InsightServicesConfig.properties" file, and an encryption key in the "es/als/security/Encryptor.properties" file. At least one specified username corresponds to a valid GitHub account.

The issue arises when the Kiuwan Local Analyzer uploads scan results to the Kiuwan SAST web application, which processes XML files containing external entities. This leads to an XML external entity injection attack. An attacker with privileges to scan source code can extract files from the operating system with the application server user's rights, potentially gaining access to sensitive files like configuration and passwords. The attacker can also initiate connections to internal systems for port scans or access other internal functions and applications.

The issue allows for an unauthenticated reflected cross-site scripting attack on the login page "login.html" when SSO (single sign-on) is enabled. This is due to the `message` request parameter values being directly included in a JavaScript block in the response. This is particularly critical in business environments using AD SSO authentication, where attackers could potentially steal AD passwords.

The issue concerns an API endpoint "/saas/rest/v1/info/application" that allows access to information about any application, using the `application` parameter. This endpoint lacks proper access control, enabling other authenticated users to read application information without the necessary rights.

The issue allows for OS Command Injection.

The issue allows for cross-site scripting (XSS), which is a type of attack where an attacker can inject malicious scripts into a website.

The issue allows for external control of file name or path.

The issue is related to an open redirect in the `shib logout.php` script, specifically with the handling of the `return` parameter. This could allow a remote attacker to redirect users to an arbitrary URL.